Howard Enos
af4ad0aea3
CS-SERVER post-reboot verification: time sync, TLS 1.2 enforcement, and Windows Server Backup feature all persisted cleanly. dcdiag clean. Ready for Entra Connect install. Synology cascadesDS permission inventory captured via DSM API (SSH disabled by default on Synology). 35 users, 4 groups, 10 shares. Analysis identifies 7 shared-account role logins (HIPAA violation), 8 departed-employee accounts to clean up, and 4 shares needing Meredith-side confirmation before migration (pacs most sensitive). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
8.3 KiB
Synology cascadesDS — Analysis + Migration Mapping (2026-04-22)
Inventory source: synology-permission-inventory.md (derived from synology-permission-inventory-raw.md)
Purpose: Feed the Phase 4 (phase4-synology.md §6.0) permission migration — CS-SERVER NTFS/SMB applied via scripts/phase2-file-shares.ps1.
Headline observations
1. Shared-account / role-based logins exist on Synology
The following Synology user accounts are role names, not individuals. Each is a HIPAA §164.312(a)(2)(i) Unique User Identification problem on the Synology — multiple humans sharing one credential when accessing PHI-bearing shares:
AccountingDining ManagerFront Deskmcnurse(Memory Care nurse)Memcare ReceptionistmemcarenurseNurse Tower
These should not be carried forward to CS-SERVER. The CS-SERVER model is per-person named accounts (already Howard's 2026-04-22 rollout plan), so at cutover these shared logins disappear and their previously-assigned permissions migrate to the appropriate AD security group.
2. Departed employees still present on Synology
Per our AD state and the 2026-04-22 working list:
| Synology user | Status |
|---|---|
Amber M Lee |
Not in AD or current roster — treat as departed |
Ann Dery |
Former employee (deleted from AD 2026-04-13) |
Anna Pitzlin |
Former employee (confirmed by HR, slated for deletion) |
Britney Thompson |
Departed 2026-04-22 per John's reply |
Haris Durut |
Former employee (deleted from AD 2026-04-13) |
Monica RamirezRossette |
Former employee (removed from Domain Admins 2026-03-09) |
Nela Durut-Azizi |
Former employee (already expired=yes on Synology) |
Tamra Johnson |
Renamed to Tamra Matthews; the Synology account is the old name |
None of these carry forward. Delete after cutover.
3. Service/admin accounts to keep or retire
| Account | Keep or retire |
|---|---|
admin |
Keep (DSM default; locked to administrators). Used only during maintenance. |
guest |
Already expired=yes. Leave disabled. HIPAA audit says remove; keep as-is for now. |
guru |
Keep (MSP / Computer Guru service account). Rotate password post-cutover. |
CasAdmin201 |
Investigate — looks like a prior-MSP admin account. Has Admin rights on every share. Recommend disable + confirm with Meredith before deletion. |
VPNClient |
Synology VPN service account; narrow purpose. Keep as-is unless VPN feature is retired. |
4. Four Synology groups, but only one is load-bearing for staff
administrators— DSM admin group. Full control everywhere.http— Web-service group, not staff-facing.MainOffice— Appears to be a custom group for office staff. This is the one we need to translate into AD groups when migrating share access.users— Default membership (every local user is a member). Most share permissions grant modest rights to this group.
Group-member enumeration via the DSM API returned error 3201; full membership will need to be captured via DSM web UI (Control Panel → User & Group → Group → double-click → Members tab) or via CLI when SSH is enabled.
5. Sandra Fish share
There's a share named Sandra Fish — former director's personal folder. Has the same deny pattern as other shares. Decision needed: archive contents to Archive\Former-Director-Sandra-Fish\ on CS-SERVER and delete the share, or keep accessible only to Meredith as custodian until retention expires (state/HIPAA).
6. pacs share
pacs likely refers to a Picture Archiving and Communication System — medical imaging. Heavy deny pattern (most users denied by default). This is a HIPAA-clinical share. Worth confirming with Meredith what's actually in it before moving — if it's live imaging of residents, EncryptData is mandatory and access should narrow to Clinical-PHI group.
7. web, Activities, chat shares
web— likely the DSM Web Station share. Mostly denied for users. Retire with Synology.Activities— Life Enrichment activity docs? Unclear. Meredith-confirm.chat— likely for DSM Chat. If unused (Teams is the planned chat per HIPAA doc), retire.
Synology → AD identity mapping
For the 2026-04-22 active roster, here is the proposed mapping. Use this to feed SG-* group memberships before phase2-file-shares.ps1 runs.
| Synology user | AD identity (SamAccountName) | AD department |
|---|---|---|
Ashley Jensen |
Ashley.Jensen |
Administrative |
ChristinaDupras |
Christina.DuPras |
Resident Services |
Crystal Rodriguez |
Crystal.Rodriguez |
Marketing |
Crystal Suszek |
(alias of Crystal Rodriguez — consolidate; no second AD account) | — |
JD Martin |
JD.Martin |
Culinary |
John Trozzi |
John.Trozzi |
Maintenance |
Karen Rossini |
karen.rossini |
Care, Assisted Living |
Lois Lane |
Lois.Lane |
Care, Assisted Living |
Lupe Sanchez |
Lupe.Sanchez |
Housekeeping |
Megan Hiatt |
Megan.Hiatt |
Marketing |
meredith kuhn |
Meredith.Kuhn |
Administrative |
Shelby Trozzi |
Shelby.Trozzi |
Memory Care |
Susan Hicks |
Susan.Hicks |
Life Enrichment |
Veronica |
Veronica.Feller |
Care, Assisted Living |
Stephanie Devin |
(not in AD — blocked in M365, former employee) | — |
Not migrated: Amber M Lee, Ann Dery, Anna Pitzlin, Britney Thompson, Haris Durut, Monica RamirezRossette, Nela Durut-Azizi, Tamra Johnson. Plus all role accounts in observation #1.
Proposed AD security group → CS-SERVER share mapping
Mirror of the Synology pattern, collapsed onto the AD security groups we're creating in the rollout (see docs/cloud/user-account-rollout-plan.md §4). Individual user ACEs from Synology merge into the matching group.
| Share | Who gets RW on CS-SERVER | Who gets RO | Notes |
|---|---|---|---|
Management |
SG-Management-RW = Administrative + Sales Director + Clinical Directors + Life Enrichment Director |
Authenticated Users (RO) | Current Synology: deny-by-default, individual grants; clean slate on CS-SERVER with group-based |
SalesDept |
SG-Sales-RW = Megan, Crystal, Tamra, Lauren, Allison, Ashley |
— | PHI concern (resident intake forms) — audit SACL required |
Server |
SG-Server-RW = Administrative + IT |
— | IT / sysadmin scratch space |
homes |
Per-user only (CREATOR OWNER for new subfolders, Domain Users read on root) |
— | Already the CS-SERVER pattern per phase2-server-prep.md |
Public |
Authenticated Users RW |
— | Non-sensitive shared area |
Culinary |
SG-Culinary-RW = JD Martin, Ramon, Alyssa |
— | Already created on CS-SERVER (per cs-server.md §SMB shares) — verify ACL |
pacs |
INVESTIGATE FIRST — clinical imaging; scope to SG-Clinical-PHI if confirmed + enable SMB3 encryption + SACL auditing |
— | Critical PHI share; do not migrate until confirmed |
Activities |
TBD — ask Meredith | TBD | Life Enrichment? |
chat, web |
Do not migrate | — | Retire with Synology |
Sandra Fish |
Archive-only access for Meredith + IT | — | Former-director data; retention decision needed |
Questions for Meredith / Howard before cutover
- What is in
pacstoday? If it's medical imaging, we treat it as the highest-sensitivity share — strict ACL, SMB3 encryption, full Object Access audit SACL, dedicatedSG-Clinical-PHIgroup. - What is in
Activities? Life Enrichment docs? HIPAA-relevant (resident participation records)? CasAdmin201— who is/was this? Used today or legacy?- Is Meredith's
Sandra Fishshare something to archive long-term or purge? chat— currently used? If not, confirm for retirement.
Next action items
- Walk through DSM Control Panel with Howard to capture the
MainOfficegroup membership (API error 3201 blocked automated pull) - Confirm with Meredith the content/use of
pacs,Activities,chat,Sandra Fish - Update
docs/migration/scripts/phase2-file-shares.ps1inputs with the mapping table above - After CS-SERVER is migrated: disable Synology shared-account logins (
Accounting,Front Desk,mcnurse,memcarenurse,Memcare Receptionist,Nurse Tower,Dining Manager) — HIPAA compliance cleanup - After CS-SERVER is migrated: disable former-employee Synology accounts (Amber, Ann, Anna, Britney, Haris, Monica, Nela, Tamra)
- Reconfigure Synology as backup target per
phase4-synology.md§6.4, retire it as a NAS